An on-screen or virtual keyboard is a software component that allows a user to enter characters into a keyboard displayed on the display. It is used by disabled users who cannot operate a physical keyboard. It has also emerged as a key method for reducing keystroke logging. There are two types of on-screen keyboards: Program to program or non- web keyboards and web-based keyboards. Non-web keyboards are the weaker of the two. These keyboards (such as the onscreen keyboard that comes with Microsoft Windows XP) send keyboard event messages to the external target program to type text. Every software keylogger can log these typed characters from one program to another. This problem persists with both third party and first party virtual keyboards. There are other means for protection in this case, like dragging and dropping the password from the on-screen keyboard to the target program.

Web-based keyboards offer more protection. Some commercial keylogging programs thankfully do not record typing on a web-based virtual keyboard. Many banks like HSBC use a virtual keyboard for password entry.

Technically, it’s possible for a malware to monitor the display and mouse to obtain the data entered via virtual keyboard. Screenshot recorders take quick and regular photographs of the desktop, and can effectively obtain the data via virtual keyboard. This is significantly harder compared to monitoring real keystrokes. If the recorder is not fast enough, it cannot effectively capture all the mouse clicks displayed.

On-screen keyboard use can also increase the risk of password disclosure by shoulder surfing. An observer can watch the screen easily (and less suspiciously) than the keyboard and see which characters the mouse moves to. Some implementations of the on-screen keyboard give visual feedback of the key clicked by, say, changing its colour briefly. This makes it much easier for an observer to read the data from the screen. This implementation may leave the focus on the most recently clicked key until the next virtual key is clicked. This allows the observer time to read each character even after the mouse starts moving to the next character. Finally, a user may not be able to point and click as fast as they could type on a keyboard, thus making it easier for the observer. This especially becomes a problem in cyber cafes that do not feature separate cubicles for privacy. Fortunately, software exists to combat some of these problems. Corallo Software’s Virtual Keyboard application provides an option to make the keyboard transparent (0-90%) when you move the cursor away. It can handle command-key combinations, modifier key-click combinations and auto-key repeat. The shareware program is applicable for 14 days before registration but a Lite freeware version is also available. Both have support for all operating systems, including Mac OS 8 and Intel-based Macs.